{"id":"CVE-2026-89552","state":"PUBLISHED","title":"params: fix charp corruption on allocation failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nparams: fix charp corruption on allocation failure\n\nparam_set_charp() stores charp parameters in allocated memory after slab is\navailable, and releases the previous value when the parameter is updated.\n\nThe previous value is released before the replacement allocation succeeds.\nIf kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter\nleft as NULL.\n\nFailing zswap's compressor update before zswap is initialized can later\ntrigger:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  RIP: 0010:strcmp+0x10/0x30\n  Call Trace:\n    zswap_setup+0x3b1/0x490\n    zswap_enabled_param_set+0x5b/0xa0\n    param_attr_store+0x93/0xe0\n    module_attr_store+0x1c/0x30\n    kernfs_fop_write_iter+0x116/0x1f0\n\nAllocate and copy the replacement first, then replace the parameter value\nonly after allocation succeeds.","publishedAt":"2026-09-11T19:44:26.091Z","updatedAt":"2026-10-30T12:32:11.008Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"72835d539ed3eb4c4b85b85a3f3976c7bdc70b91","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"c7cc1edf3c0de948abcb3e4a44ee86a82403ce2f","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"32c1f305cfad192cd98468140beedeffe4792f53","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"31b41ea8383d51992d6b0dfe3a99da1dec8ce1c1","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"614f873268c5b172804c9af6639bd17b7e1e2359","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"704ecd010d4a9b33160e40b74eb402f6b86a18e0","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"0d8e2404925a0607ffec79a53170715a46936896","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"3dfaae04243cde460d82dfc2a7dd0bb6664d20ae","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/params.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.30","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/params.c"]}],"references":["https://git.kernel.org/stable/c/72835d539ed3eb4c4b85b85a3f3976c7bdc70b91","https://git.kernel.org/stable/c/c7cc1edf3c0de948abcb3e4a44ee86a82403ce2f","https://git.kernel.org/stable/c/32c1f305cfad192cd98468140beedeffe4792f53","https://git.kernel.org/stable/c/31b41ea8383d51992d6b0dfe3a99da1dec8ce1c1","https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359","https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0","https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896","https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89552.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89552","state":"PUBLISHED","datePublished":"2026-09-11T19:44:26.091Z","dateUpdated":"2026-10-30T12:32:11.008Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.723Z"},"containers":{"cna":{"title":"params: fix charp corruption on allocation failure","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nparams: fix charp corruption on allocation failure\n\nparam_set_charp() stores charp parameters in allocated memory after slab is\navailable, and releases the previous value when the parameter is updated.\n\nThe previous value is released before the replacement allocation succeeds.\nIf kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter\nleft as NULL.\n\nFailing zswap's compressor update before zswap is initialized can later\ntrigger:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  RIP: 0010:strcmp+0x10/0x30\n  Call Trace:\n    zswap_setup+0x3b1/0x490\n    zswap_enabled_param_set+0x5b/0xa0\n    param_attr_store+0x93/0xe0\n    module_attr_store+0x1c/0x30\n    kernfs_fop_write_iter+0x116/0x1f0\n\nAllocate and copy the replacement first, then replace the parameter value\nonly after allocation succeeds."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"72835d539ed3eb4c4b85b85a3f3976c7bdc70b91","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"c7cc1edf3c0de948abcb3e4a44ee86a82403ce2f","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"32c1f305cfad192cd98468140beedeffe4792f53","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"31b41ea8383d51992d6b0dfe3a99da1dec8ce1c1","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"614f873268c5b172804c9af6639bd17b7e1e2359","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"704ecd010d4a9b33160e40b74eb402f6b86a18e0","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"0d8e2404925a0607ffec79a53170715a46936896","versionType":"git"},{"version":"e180a6b7759a99a28cbcce3547c4c80822cb6c2a","status":"affected","lessThan":"3dfaae04243cde460d82dfc2a7dd0bb6664d20ae","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/params.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.30","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/params.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/72835d539ed3eb4c4b85b85a3f3976c7bdc70b91"},{"url":"https://git.kernel.org/stable/c/c7cc1edf3c0de948abcb3e4a44ee86a82403ce2f"},{"url":"https://git.kernel.org/stable/c/32c1f305cfad192cd98468140beedeffe4792f53"},{"url":"https://git.kernel.org/stable/c/31b41ea8383d51992d6b0dfe3a99da1dec8ce1c1"},{"url":"https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359"},{"url":"https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0"},{"url":"https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896"},{"url":"https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:11.008Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}